Secrecy of Bipartite Quantum Channels with Local Environment Assistance 
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We investigate secrecy properties of bipartite quantum channels when local environment called 
shield system is assisted. Two honest parties apply either the classical distillation such as the stan- 
dard one-way postprocessing followed by the advantage distillation (AD), or the quantum distillation 
applying the recurrence protocol. We then identify those entangled states that can be converted to 
secrecy by either the quantum or the classical distillation. Remarkably much wider range of bound 
entangled states are shown to be distilled to secrecy. 

PACS numbers: 03.67.Dd, 03.65.Ud, 03.67.-a 



Security of quantum communication is ensured by 
two characteristics of a maximally entangled state e.g. 
|0i) = (|00) + |ll))/v / 2 : i)it is a pure state that has 
no correlation with environment, and ii) its measurement 
outcomes exploit the perfect correlation between shares. 
Much effort has been then devoted to characterize those 
entangled states that can be transformed to the |0i) 
by local operation and classical communication (LOCC), 
which are called distillable entanglement [2jj. Analogous 
to the entanglement |0i), a secret key [l[ is the resource 
that enables two honest parties, Alice and Bob, to pro- 
ceed to information-theoretically secure classical commu- 
nication. It turns out that entangled states can be used 
to distribute secret keys and we will call those en- 
tangled states key- distillable. It is however unclear yet 
to confirm if entanglement itself would be the resource 
for secrecy Q. This is in fact a fundamental issue on 
the compatibility between entanglement and secrecy in 
Quantum Information Theory, and also an important is- 
sue in practice when the noise threshold of Quantum Key 
Distribution(QKD) protocols is analyzed, in particular 
for cases over long-distances where the rate of errors is 
higher in general [4]. 

Distillable entanglement is obviously key-distillable 
since the state |0i) immediately means to provide a secret 
key after measurement in the computational basis. The 
correspondence has been used in obtaining certain secu- 
rity bounds in QKD protocols e.g. the Bennett-Brassard 
(BB84) protocol 0. In general, entanglement itself can 
be used to establish secret (classical) correlations Q , that 
cannot be prepared by local operation and public com- 
munication, but secrecy is some other. Recent progress 
along the line has actually gone beyond the limit of distil- 
lable entanglement, showing an example of key-distillable 
bound entangled states This resolves and strength- 
ens the connection between entanglement and secrecy, 
although the bound entangled state shown in the exam- 
ple can be arbitrarily close to the border of distillable 
entanglement. Then, the concern lies on the whole range 
of bound entangled states Q ■ 

In this Letter, we analyze secrecy properties of bipar- 
tite quantum states, taking into account local environ- 



ment so-called shield systems of two honest parties. The 
distillation protocol is either the quantum one that ap- 
plies the recurrence protocol , or the classical one that 
applies the standard one-way postprocessing followed by 
the AD . We then derive simple key-distillability con- 
ditions, which show that remarkably, much wider range of 
bound entangled sates are turned out to be key-distillable 
by the classical distillation. 

Taking into account local environment in key distil- 
lation [8| two honest parties hold both systems: one is 
the key part AB to be directly used for key distillation, 
and the other is the shield part A'B' that shares classical 
correlations with the key one. Since no distillable corre- 
lation exists between the two systems, shield states does 
not help an eavesdropper, Eve, to have more about se- 
crecy of the key part. Nevertheless, the existence of shield 
systems makes differences compared to security analysis 
only with the key part. First, the quantum states pro- 
viding general security over ABA' B' are characterized by 
private states, 

lABA'B' — U A BA'B>(\4>i)ab(4>i \ ® RA'B')U\ BA , B ,, (1) 

where pa'b> is a shield state and Uaba'B 1 is a unitary 
operation called twisting of the following form 



U A 



BA'B' 



(2) 



which composes the equivalence class of private states. 
Next, the shield system A'B' plays the role of degrad- 
ing the purification power of Eve. This means that the 
whole amount of phase error is caused not fully by Eve 
but also by a twisting operation Uaba'B'- Consequently, 
two honest parties do not have to completely correct the 
phase error to ensure the general security. In the follow- 
ing section, all this can be seen more quantitatively. 

Before starting key distillation protocols, two honest 
parties first apply the quantum state tomography to iden- 
tify shared states in a single-copy level. Suppose that the 
single-copy state over the key and the shield parts is iden- 
tified as follows, 

PABA'B' = |0l)(0l|AB ® Ol + |02) (02 \aB ® £T 2 

+ |03)(03Ub ® 0- 3 + |04)(04Us <8> 04, (3) 



2 



where aj, j = 1,2,3,4, are unnormalized shield states 
of systems A'B' and \<j>i), j = 1,2,3,4 are Bell states, 
in terms of Pauli matrices, \4> 2 ) = (1 ® Z)\<f>i), \<j> 3 ) = 
and |^ 4 ) = The state shared in 

the key part is denoted by, pab = J2j Pj\4>j){4>j\i where 
fij = tr[<Tj], j = 1,2,3,4. Here we restrict to that the key 
part shares Bell-diagonal states, and if it is not the case 
we suppose that two honest parties apply local filtering 
operations [ll| to the key part, to share bell-diagonal 
states. For paba'B' in |3j), there exists a twisting U such 
that Paba'B' = Uuaba' B'U^ [HI in which, the shield 
part A'B' being traced out, 



oab = Ai|0i)(0i| 

+ A3 (03 I 



A 4 |0 4 )((/>4| 



(4) 



ith 



Ai, 2 = -(||<Ti + er 2 || ± - <7 2 ||), 

A3,4 = ^(||0"3 + C4|| ± 11^3 - C4||). (5) 



Here note that the <jab has less phase errors than the 
Pab [171 ]. This means that not all errors from pab have 
to be corrected for distilling a secret key, instead it suf- 
fices to correct the errors from <jab since a secret key cor- 
responds to a private state which also consists of phase 
errors due to the twisting effect on the \<\>\). Then the 
question arisen is whether distillation steps to correct 
errors existing in ctab commute with any twisting opera- 
tion. The quantum and classical protocols to be consid- 
ered throughout the paper are in fact in the case 



Therefore, identifying the untwisted state o~ab, two hon- 
est parties will know the errors that should be corrected, 
from which they can quantify if pab A' B' is key-distillable 
by the aforementioned distillation protocols. The precon- 
dition for key distillability [12J is that <jab is entangled, 
which holds if and only if Ai > A2 + A3 + A4 [13j , and in 
terms of shield states 



01 - cr 2 > 03 + 04 



(6) 



To prove the general security, in fact one should go 
through the analysis of the most general attack by Eve. 
In the case, two honest parties share general N symmet- 
ric states, P^aba'B' which is invariant under any permu- 
tations of copies such that each single state is identical: 
^N-iPaba'B' = PABA'B'- There could exist correlations 
among N symmetric states [l3 |. to which the analysis 
is in general a hard task. Recently, Renner has proven 
the quantum de Finetti theorem in the exponential form, 
which leads a huge simplification in the analysis. The 
theorem tells that whenever the shared state Paba'B 1 1S 
symmetric for arbitrarily large N, not necessarily going 
through the most general attack [l5( instead two honest 
parties can safely assume the so-called collective attacks 
Pab A'B' f° r * ne g enera l security. 



We now consider key distillation from p'aba'B' • 

The 

state paba'B' is simply key-distillable if pab is entan- 
gled since all two-qubit entangled states are distillable. 
To avoid the overlap with distillable entanglement, we 
here assume that paba'B' is bound entangled. In what 
follows, we derive the key-distillability condition when 
two honest parties apply the recurrence protocol, which 
works as follows [9]. Taking two copies of Paba'B', two 
honest parties first apply the CNOT operation to their 
first (controlled bit) and second(target bit) key systems 
and measure the second key systems. Their measure- 
ment outcomes are announced, and if both measurement 
outcomes are the same they repeat the procedure again 
to the remaining pair with another pair, otherwise they 
start again with another two pairs. A remaining state 
after passing m repetitions is denoted by a m [161 ]. Key 
distillability can be answered by the useful formula [3] , 



||(00K|11)|| = ^pAB(0,0)pAB(l,l)F(p t) E ,p 1 E ), (7) 

where F(p° E ,p E ) is the fidelity between two states p J E , 
j = 0,1, after two honest parties share both the same 
value j. The property of secret key tells that the rhs of 
([7|) is arbitrarily close to 1/2 if and only if two honest 
parties share a secret key [l|. Therefore, a secret key can 
be distilled from o~ m if and only if 



11(001^111)11 = 



2 01 + 02 r + 2 0-3 + 04 



(8) 



can be arbitrarily close to 1/2 as repetitions m become 
very large. For such a convergence the shield states 
should fulfill that 



01 + 02 



01 - 02 



(9) 



since ||<7i +02II is the most dominant in {8]| from the con- 
dition in ©. The condition can be expressed equiv- 
alently as their orthogonality tr[eri<72] = [16]. Here 
note that correlations existing in shield states do not 
contribute the security condition, and the global prop- 
erty of them, orthogonality, matters. One can also relax 
the condition §§§ to an e— neighborhood of private states: 
if tr[<7i<7 2 ] < S for 5 > then there exists e > a func- 
tion of 6 such that ||0 m — Paba'B' \\ < e, by the recurrence 
protocol. 

Proposition 1. A bound entangled states Paba'B' is 
key-distillable by the recurrence protocol if and only if i) 
o~ab is entangled ([6]) and ii) shield sates o~± and o~2 are 
orthogonal ([9]). 

Example. We reconsider the example in Ref. [8| which 
takes the followings as shield states in ((3|, 



01 

03,4 



Ps 



p( 



02 = PPs 



' Pa ^<g>; 



(10) 
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Quantum Distillation 



ABAB'E 



Measurement 



Measurement 



Classical Distillation 
P(A,B,y E ) I > Secret Key 

FIG. 1: Key distillation from quantum states follows either 
measurement followed by quantum distillation of a private 
state, or classical distillation followed by measurement. The 
U is a twisting operation in J2J. 



where p a ( s ) is the normalized d-dimensional projection 
operator onto asymmetric(symmetric) space. The state 
Pab A' B' is bound entangled if and only if p £ (0, 1/3) and 
P < (1 + (d/(d - l))')" 1 - Applying the key distillability 
condition ([9]) to this state, one obtains trftri^] = 0(2~ l ), 
which means that two shield states can be made arbitrar- 
ily orthogonal to satisfy ((9]) as I increases. The chosen 
shield states in fact play the role of increasing the orthog- 
onality of themselves, while pabA'B' is bound entangled 
for sufficiently large I, a certain range of p, and the pro- 
jector's dimension d. Note that the shield states should 
be of large dimension to satisfy the orthogonality. [8( . 

We now move to the classical key distillation method, 
that applies the standard one-way postprocessing fol- 
lowed by the AD [3] . This is an alternative to the quan- 
tum protocol (see, Fig[TJ), but realistic in the sense that it 
only applies currently feasible technology such as single- 
copy level measurement plus classical processing. After 
identifying the shared state in a single-copy level in ([3]), 
two honest partes analyze the errors that should be cor- 
rected. As we have discussed before, it suffices to correct 
only the errors arisen from the untwisted state a ab in 
but not all: phase errors are less in the oab than 
in the pab- Note that parameters identifying the uab 
in (O can also be directly estimated by LOCC protocols 
[201 ] . After the parameter estimation, two honest parties 
measure the key part of Paba'B' m the computational 
basis and share secret correlations through measurement 
outcomes, called raw keys of the probability distribution 
Pab- Then, the key distillation protocol proceeds with 
the raw keys, to correct errors existing in pab that orig- 
inated from the uab rather than pab- We here remind 
that the classical distillation protocol commutes with a 
twisting operation [2l|. 

In what follows, we describe the classical distillation 
protocol, which is known as the most tolerant to date. 
Sharing secret correlations pab, two honest parties ap- 
ply the AD that involves two-way classical communica- 
tion [13], which works as follows. Alice first generates a 
secret bit sa and computes a list x\ — sa + at with her 
measurement outcomes a», i — ,N, and then an- 



nounces Xi through a public and authenticated channel 
so that Bob can also compute bi + X4 = yi . Bob will see 
that his resulting values are either all the same or not, 
and reply to Alice with acceptance or rejection, depend- 
ing on the computation result. He says acceptance if all 
yi are the same, and proceeds to apply one-way error cor- 
rection and privacy amplification to the accepted values. 
Otherwise, two honest parties leave from the failed val- 
ues and perform the protocol with another values again. 
The AD is a post-selection processing to take stronger 
bit-correlations p' AB from the initial ones pab- Then, 
the security can be ensured if the one-way postprocessing 
converts p' AB to secrecy, i.e. the lower bound of one-way 
secret key rate, > I (A : B) — I (A : E), is posi- 
tive [Sill 113 ■ To summarize, the classical distillation 
incorporates the AD before the one-way postprocessing. 

The key distillability of the protocol has been com- 
pletely analyzed in Refs. [2^, [24j: uab is distillable if the 
parameters Xj in ([5]) satisfy (Ai — A2) 2 > (A3 + A 4 )(Ai + 
A2). Then, straightforwardly from the relation in ([5]), we 
arrive at the following proposition. 

Proposition 2. A bound entangled state Paba'B' is 
key-distillable by the classical distillation if and only if i) 
its untwisted state uab is entangled i.e. ((6|) and ii) shield 
sates satisfy the following 



O2H > 03 + 0-4 ||<7i +CT 2 | 



(11) 



Let us remind the bound entangled state in the exam- 
ple fTO]) , which is key-distillable in a tiny range of bound 
entanglement. The following proposition tells that the 
more range would be key-distillable. 

Proposition 3. Let Sr and Sc denote the sets of 
quantum states key-distillable by the recurrence proto- 
col and by the considered classical protocol, respectively. 
Then, S R d S C - 

Proof. Suppose that Paba'B' G Sr, so i) uab is en- 
tangled and ii) it fulfills ([9]). The classical distillation is 
applied to those key-distillable states. Since shield states 
fulfill ([9]), the security condition (fTTj) becomes the same 
with the condition that uab is entangled in ([6]). This 
thus shows that Sr c Sc- O 

In addition, the proposition 3 shows that, for a par- 
ticular choice of separable shield states such that ((9|) 
holds, entanglement itself means secrecy when its un- 
twisted state uab is entangled. This is because the en- 
tanglement condition (J6]) becomes the same with the se- 
curity condition (fTTj) by the orthogonality condition ([9]). 
The gap between entanglement and secrecy then remains 
for bound entangled states Paba'B 1 not satisfying (fTTf . 
All this can be seen more quantitatively in the following. 

Example. Let us retake the shield states in (fT0|) . Since 
shield states are separable the state gab is entangled if 
p < pi where 
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FIG. 2: Those bounds of non-PPT(NPPT), PPT, key- 
distillable, separable in the example are shown. 



and Paba'B' is of PPT for p < 1/3. From the key dis- 
tillability condition (fTTj) , the state is key-distillable by 
the classical distillation protocol if p > p2- This shows 
that the state pabA'B' is key-distillable with small size 
of shield states i.e. I > 1, differently from the case of the 
recurrence protocol where I should be large enough. Note 
that as I goes very large, P2 converges to p\. From Fig. 
([2]) the entanglement condition is generally weaker than 
the security bound, so the gap between and entanglement 
and secrecy still remains. 

To summarize, we have identified those entangled 
states that are key-distillable by the known classical and 
quantum distillation protocols, while considering local 
environment in the security analysis. Then, much wider 
range of bound entangled states are turned out to be key- 
distillable, and for a particular choice of shield states, 
entanglement itself means the general security. It is also 
shown that, while local environment is considered in the 
key distillation scenario, the classical distillation could 
tolerate higher rates of errors than the quantum distil- 
lation. This is noteworthy for QKD protocols in long- 
distances, that work with high rates of errors in general. 
Notwithstanding, the result presented here is not mislead 
to that the classical is superior than any quantum pro- 
tocols. Rather, there may exist a more general quantum 
key distillation protocol. That is, what we have shown 
implies that, when known distillation protocols apply to 
bound entangled states in ([3]) considering local environ- 
ment, it is optimal to measure the key part right after 
quantum states are shared. It still remains open if en- 
tanglement itself implies secrecy in general, and this is 
actually related to the existence of bipartite bound infor- 
mation. 

Finally, we would like to mention that known secu- 
rity bounds of QKD protocols may be improved further- 
by considering local environment of two honest parties. 
This holds true whenever the shared state is of the form in 
©. In fact, earlier works presented in Refs. 14, 2^, 
apply local operations to create shield states in such a 
way that not all them are the same. Then, as we have 
discussed, not all errors have to be corrected. For in- 
stance, the bound 11% of the BB84 protocol has been 
improved up to 12.1% by considering distillation of a pri- 
vate state having a local and individual twisting i.e. in 
©t/^'- 8 ' = Uf <g) Uf dHH, and even up to 12.9% us- 
ing a local and collective n— copy twisting [26| i.e. for 
copies, U ( ^ A , B , = 



A'{n) f 



)U? ^ where 
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